@intx/workflow-host 0.2.2 → 0.4.0

package/dist/seams/scheduler.js

@@ -26,17 +26,19 @@
 //
 // The scheduler reads workflow-event blobs at the canonical layout
 // `runs/<runId>/events/<seq>.json` and writes a fresh blob at the
-// next-seq slot for each `TimerFired` commit. The blob envelope
-// carries `{ seq, type, data }` at the top level: `seq` is the
-// integer that also appears in the filename, `type` is the
-// `subscribeKind` discriminator the scheduler narrows on, and `data`
-// carries the timer payload. The workflow-run kind handler's
-// `validatePush` enforces that every event blob's body `seq` matches
-// the filename's seq, so the scheduler mints the next seq inside the
-// `writeTreePreservingPrefix` merge step and writes both into the
-// envelope and the filename.
+// next-seq slot for each `TimerFired` commit. The blob envelope is
+// FLAT -- `{ seq, type, ...eventFields }` -- matching the runtime
+// repo-store's `workflowEventToOnDisk` and the workflow-run kind
+// handler's `EventEnvelope` contract: `seq` is the integer that also
+// appears in the filename, `type` is the `subscribeKind` discriminator
+// the scheduler narrows on, and the timer fields (`timerId`, `fireAt`,
+// ...) sit alongside them, NOT under a nested `data` object. The kind
+// handler's `validatePush` enforces that every event blob's body `seq`
+// matches the filename's seq, so the scheduler mints the next seq
+// inside the `writeTreePreservingPrefix` merge step and writes both
+// into the envelope and the filename.
 import { type } from "arktype";
-import { subscribeKind } from "@intx/hub-sessions/substrate";
+import { requireEventSeq, subscribeKind, WORKFLOW_RUN_EVENTS_DIR, WORKFLOW_RUN_RUNS_PREFIX, } from "@intx/hub-sessions/substrate";
 /**
  * Substrate-shape envelope for the workflow-event blob committed to
  * `runs/<runId>/events/<seq>.json`. The validator covers the two
@@ -49,14 +51,27 @@ import { subscribeKind } from "@intx/hub-sessions/substrate";
 export const TimerEventEnvelope = type({
     seq: "number >= 0",
     type: "'TimerSet' | 'TimerFired'",
-    data: {
-        timerId: "string",
-        "fireAt?": "string",
-        "stepId?": "string | null",
-        "cron?": "string | null",
-    },
+    // FLAT on-disk shape, matching the runtime repo-store's `workflowEventToOnDisk`
+    // ({ seq, type, ...eventFields }) and the substrate's enforced `EventEnvelope`
+    // contract -- NOT a nested `data` object. The scheduler was the lone component
+    // writing/reading a nested `data` envelope; nothing else parsed it, so a
+    // deployed timer never round-tripped until this was aligned.
+    timerId: "string",
+    "fireAt?": "string",
+    "stepId?": "string | null",
+    "cron?": "string | null",
+    "+": "ignore",
 });
 export function createWorkflowHostScheduler(opts) {
+    // Production arms the global timer; a caller supplying its own can fire a
+    // queued timer on demand instead of waiting out its delay.
+    const schedule = opts.scheduleTimeout ??
+        ((handler, ms) => {
+            const handle = setTimeout(handler, ms);
+            return () => {
+                clearTimeout(handle);
+            };
+        });
     const queues = new Map();
     const liveSubscriptions = [];
     let started = false;
@@ -81,7 +96,7 @@ export function createWorkflowHostScheduler(opts) {
         if (queues.has(key))
             return; // idempotent
         const delayMs = Math.max(0, fireAtMs - opts.clock().getTime());
-        const timeout = setTimeout(() => {
+        const cancelTimeout = schedule(() => {
             void fireTimer(runId, timerId).catch((cause) => {
                 // The scheduler's commit failed. Surface as unhandled so
                 // operators see it; the runtime body's awaiter will hang
@@ -91,7 +106,7 @@ export function createWorkflowHostScheduler(opts) {
                     : new Error(`scheduler ${String(repoId.id)}/${runId}/${timerId} commit failed: ${String(cause)}`);
             });
         }, delayMs);
-        queues.set(key, { runId, timerId, fireAtMs, timeout, cron });
+        queues.set(key, { runId, timerId, fireAtMs, cancelTimeout, cron });
     }
     function startLiveSubscription(repoId) {
         const abort = new AbortController();
@@ -106,21 +121,21 @@ export function createWorkflowHostScheduler(opts) {
                     break;
                 if (entry.event.type !== "TimerSet")
                     continue;
-                const fireAt = entry.event.data.fireAt;
+                const fireAt = entry.event.fireAt;
                 if (fireAt === undefined) {
-                    throw new Error(`scheduler live ingest: TimerSet in ${String(repoId.id)} run ${entry.runId} timer ${entry.event.data.timerId} missing fireAt`);
+                    throw new Error(`scheduler live ingest: TimerSet in ${String(repoId.id)} run ${entry.runId} timer ${entry.event.timerId} missing fireAt`);
                 }
                 const fireAtMs = Date.parse(fireAt);
                 if (Number.isNaN(fireAtMs)) {
-                    throw new Error(`scheduler live ingest: TimerSet in ${String(repoId.id)} run ${entry.runId} timer ${entry.event.data.timerId} fireAt unparseable: ${fireAt}`);
+                    throw new Error(`scheduler live ingest: TimerSet in ${String(repoId.id)} run ${entry.runId} timer ${entry.event.timerId} fireAt unparseable: ${fireAt}`);
                 }
-                const cron = entry.event.data.cron !== undefined && entry.event.data.cron !== null;
+                const cron = entry.event.cron !== undefined && entry.event.cron !== null;
                 if (cron && fireAtMs < opts.clock().getTime()) {
                     // Same missed-cron-tick spec as recovery: a cron TimerSet
                     // whose fireAt is in the past on arrival is dropped.
                     continue;
                 }
-                enqueue(repoId, entry.runId, entry.event.data.timerId, fireAtMs, cron);
+                enqueue(repoId, entry.runId, entry.event.timerId, fireAtMs, cron);
             }
         })();
         liveSubscriptions.push({ abort, done });
@@ -133,24 +148,24 @@ export function createWorkflowHostScheduler(opts) {
         const unfired = new Map();
         for (const e of events) {
             if (e.envelope.type === "TimerSet") {
-                const fireAt = e.envelope.data.fireAt;
+                const fireAt = e.envelope.fireAt;
                 if (fireAt === undefined) {
-                    throw new Error(`scheduler recovery: TimerSet in ${String(repoId.id)} run ${e.runId} timer ${e.envelope.data.timerId} missing fireAt`);
+                    throw new Error(`scheduler recovery: TimerSet in ${String(repoId.id)} run ${e.runId} timer ${e.envelope.timerId} missing fireAt`);
                 }
                 const fireAtMs = Date.parse(fireAt);
                 if (Number.isNaN(fireAtMs)) {
-                    throw new Error(`scheduler recovery: TimerSet in ${String(repoId.id)} run ${e.runId} timer ${e.envelope.data.timerId} fireAt unparseable: ${fireAt}`);
+                    throw new Error(`scheduler recovery: TimerSet in ${String(repoId.id)} run ${e.runId} timer ${e.envelope.timerId} fireAt unparseable: ${fireAt}`);
                 }
-                const cron = e.envelope.data.cron !== undefined && e.envelope.data.cron !== null;
-                unfired.set(`${e.runId} ${e.envelope.data.timerId}`, {
+                const cron = e.envelope.cron !== undefined && e.envelope.cron !== null;
+                unfired.set(`${e.runId} ${e.envelope.timerId}`, {
                     runId: e.runId,
-                    timerId: e.envelope.data.timerId,
+                    timerId: e.envelope.timerId,
                     fireAtMs,
                     cron,
                 });
             }
             else {
-                unfired.delete(`${e.runId} ${e.envelope.data.timerId}`);
+                unfired.delete(`${e.runId} ${e.envelope.timerId}`);
             }
         }
         const now = opts.clock().getTime();
@@ -196,7 +211,7 @@ export function createWorkflowHostScheduler(opts) {
                 return;
             stopped = true;
             for (const t of queues.values())
-                clearTimeout(t.timeout);
+                t.cancelTimeout();
             queues.clear();
             for (const sub of liveSubscriptions.splice(0)) {
                 sub.abort.abort();
@@ -210,7 +225,7 @@ export function createWorkflowHostScheduler(opts) {
             const entry = queues.get(key);
             if (entry === undefined)
                 return;
-            clearTimeout(entry.timeout);
+            entry.cancelTimeout();
             queues.delete(key);
         },
         queuedTimers() {
@@ -224,14 +239,15 @@ export function createWorkflowHostScheduler(opts) {
 }
 /**
  * Read every timer-event blob across every run under the given
- * workflow-run repo. The recovery walk reads blobs from the
- * substrate's on-disk working tree directly via `enumerateEventBlobs`:
- * `subscribeKind` is a diff-shaped iterator over new commits, not a
- * "list everything at HEAD" primitive, so the startup ledger needs a
- * path-aware enumeration of the current ref tip rather than a tail
- * subscription. The substrate writes commit-then-checkout for every
- * ref-update, so the working tree is a coherent snapshot of the
- * current ref tip.
+ * workflow-run repo. Recovery reconstructs its ledger from committed
+ * state, so `enumerateEventBlobs` reads the git object store at the
+ * events ref tip via `openCommittedReads` rather than the materialized
+ * working tree, whose non-atomic post-commit checkout can lag the
+ * committed tree on a contended filesystem and hide an already-committed
+ * `TimerFired`. `subscribeKind` is a diff-shaped iterator over new
+ * commits, not a "list everything at HEAD" primitive, so the startup
+ * ledger needs this path-aware enumeration of the current ref tip rather
+ * than a tail subscription.
  */
 async function readAllEvents(opts, repoId) {
     const entries = [];
@@ -261,53 +277,36 @@ async function readAllEvents(opts, repoId) {
  * has none.
  */
 async function enumerateEventBlobs(opts, repoId) {
-    const dir = opts.repoStore.getRepoDir(repoId);
-    const fs = await import("node:fs/promises");
-    const path = await import("node:path");
-    const runsDir = path.join(dir, "runs");
+    const reads = await opts.repoStore.openCommittedReads(opts.principal, repoId, opts.ref);
+    if (reads === null)
+        return [];
     const out = [];
-    let runEntries;
-    try {
-        runEntries = await fs.readdir(runsDir);
-    }
-    catch (cause) {
-        if (isErrnoNotFound(cause))
-            return out;
-        throw cause;
-    }
-    for (const runId of runEntries) {
-        const eventsDir = path.join(runsDir, runId, "events");
-        let blobs;
-        try {
-            blobs = await fs.readdir(eventsDir);
-        }
-        catch (cause) {
-            if (isErrnoNotFound(cause))
-                continue;
-            throw cause;
-        }
+    const runEntries = await reads.listDir(WORKFLOW_RUN_RUNS_PREFIX);
+    for (const runEntry of runEntries) {
+        if (runEntry.type !== "tree")
+            continue;
+        const runId = runEntry.name;
+        const eventsDir = `${WORKFLOW_RUN_RUNS_PREFIX}/${runId}/${WORKFLOW_RUN_EVENTS_DIR}`;
+        const blobs = await reads.listDir(eventsDir);
         for (const blob of blobs) {
-            if (!/^(0|[1-9][0-9]*)\.json$/.test(blob))
+            if (blob.type !== "blob")
                 continue;
-            const raw = await fs.readFile(path.join(eventsDir, blob), "utf8");
+            // Assert a legal <seq>.json name; an illegal one under the events
+            // prefix is corruption the recovery walk must not silently drop.
+            requireEventSeq(blob.name, `${eventsDir}/${blob.name}`);
+            const raw = await reads.readBlobByOid(blob.oid);
             let parsed;
             try {
-                parsed = JSON.parse(raw);
+                parsed = JSON.parse(new TextDecoder().decode(raw));
             }
             catch (cause) {
-                throw new Error(`scheduler recovery: cannot parse ${String(repoId.id)}/${runId}/events/${blob}: ${String(cause)}`);
+                throw new Error(`scheduler recovery: cannot parse ${String(repoId.id)}/${runId}/${WORKFLOW_RUN_EVENTS_DIR}/${blob.name}: ${String(cause)}`);
             }
             out.push({ runId, payload: parsed });
         }
     }
     return out;
 }
-function isErrnoNotFound(cause) {
-    if (cause === null || typeof cause !== "object")
-        return false;
-    const code = cause.code;
-    return code === "ENOENT";
-}
 /**
  * Commit a `TimerFired` event blob to the workflow-run repo. The
  * commit goes through `writeTreePreservingPrefix` so concurrent
@@ -321,7 +320,7 @@ async function commitTimerFired(opts, runId, timerId) {
     if (owningRepoId === undefined) {
         throw new Error(`scheduler commit: cannot find deployment owning run ${runId}`);
     }
-    const prefix = `runs/${runId}/events/`;
+    const prefix = `${WORKFLOW_RUN_RUNS_PREFIX}/${runId}/${WORKFLOW_RUN_EVENTS_DIR}/`;
     await opts.repoStore.writeTreePreservingPrefix(opts.principal, owningRepoId, opts.ref, {
         preservePrefix: prefix,
         merge: async (existing) => {
@@ -329,13 +328,7 @@ async function commitTimerFired(opts, runId, timerId) {
             let alreadyFired = false;
             for (const [filepath, contents] of existing) {
                 const name = filepath.slice(prefix.length);
-                const match = /^(0|[1-9][0-9]*)\.json$/.exec(name);
-                if (match === null)
-                    continue;
-                const seqStr = match[1];
-                if (seqStr === undefined)
-                    continue;
-                const seq = Number.parseInt(seqStr, 10);
+                const seq = requireEventSeq(name, `${prefix}${name}`);
                 if (seq > maxSeq)
                     maxSeq = seq;
                 try {
@@ -360,7 +353,7 @@ async function commitTimerFired(opts, runId, timerId) {
             out[`${prefix}${String(nextSeq)}.json`] = JSON.stringify({
                 seq: nextSeq,
                 type: "TimerFired",
-                data: { timerId },
+                timerId,
             });
             return out;
         },
@@ -373,25 +366,22 @@ function isMatchingTimerFired(parsed, timerId) {
     const obj = parsed;
     if (obj.type !== "TimerFired")
         return false;
-    if (obj.data === undefined)
-        return false;
-    return obj.data.timerId === timerId;
+    return obj.timerId === timerId;
 }
 async function findOwningDeployment(opts, runId) {
     const repoIds = await opts.listActiveDeployments();
-    const fs = await import("node:fs/promises");
-    const path = await import("node:path");
     for (const repoId of repoIds) {
-        const dir = opts.repoStore.getRepoDir(repoId);
-        try {
-            await fs.access(path.join(dir, "runs", runId, "events"));
+        const reads = await opts.repoStore.openCommittedReads(opts.principal, repoId, opts.ref);
+        if (reads === null)
+            continue;
+        // The committed events subtree exists only when it holds at least
+        // one blob (git does not track empty trees), so a non-empty listing
+        // is exactly "this deployment owns the run". Reading committed state
+        // rather than the working tree keeps attribution correct when the
+        // checkout lags the object store.
+        const events = await reads.listDir(`${WORKFLOW_RUN_RUNS_PREFIX}/${runId}/${WORKFLOW_RUN_EVENTS_DIR}`);
+        if (events.length > 0)
             return repoId;
-        }
-        catch (cause) {
-            if (isErrnoNotFound(cause))
-                continue;
-            throw cause;
-        }
     }
     return undefined;
 }

package/dist/supervisor/cancel-signing.d.ts

@@ -16,8 +16,8 @@ export type CommitCancelRequestedOpts = {
     repoId: RepoId;
     /** Events ref the workflow-run repo writes to. */
     ref: string;
-    /** Deployment id used to construct the supervisor principal. */
-    deploymentId: string;
+    /** Anchor run id used to construct the supervisor principal. */
+    anchorRunId: string;
     /** Run id whose event log receives the CancelRequested entry. */
     runId: string;
     /** Cancellation origin from the Q3 map. */

package/dist/supervisor/cancel-signing.js

@@ -24,6 +24,7 @@
 // `supervisor`-kind principal), which is the cross-check the
 // supervisor's runtime-side signing keeps coherent.
 import { type } from "arktype";
+import { parseEventSeq } from "@intx/hub-sessions/substrate";
 import { hexEncode } from "@intx/types";
 /**
  * Path inside the workflow-run repo each `CancelRequested` event
@@ -40,7 +41,6 @@ const EVENTS_DIR = "events";
  * push principal and enforces the principal-vs-origin map.
  */
 export const SUPERVISOR_PRINCIPAL_KIND = "supervisor";
-const EVENT_FILENAME_RE = /^(0|[1-9][0-9]*)\.json$/;
 const OnDiskEnvelope = type({
     seq: "number >= 0",
     type: "string",
@@ -76,7 +76,7 @@ export async function commitCancelRequested(opts) {
     const prefix = `${RUNS_PREFIX}/${opts.runId}/${EVENTS_DIR}/`;
     const principal = {
         kind: SUPERVISOR_PRINCIPAL_KIND,
-        deploymentId: opts.deploymentId,
+        anchorRunId: opts.anchorRunId,
     };
     let resolved = null;
     const { commitSha } = await opts.substrate.writeTreePreservingPrefix(principal, opts.repoId, opts.ref, {
@@ -85,13 +85,9 @@ export async function commitCancelRequested(opts) {
             let maxSeq = -1;
             for (const filepath of existing.keys()) {
                 const name = filepath.slice(prefix.length);
-                const match = EVENT_FILENAME_RE.exec(name);
-                if (match === null)
+                const seq = parseEventSeq(name);
+                if (seq === null)
                     continue;
-                const seqStr = match[1];
-                if (seqStr === undefined)
-                    continue;
-                const seq = Number.parseInt(seqStr, 10);
                 if (seq > maxSeq)
                     maxSeq = seq;
             }

package/dist/supervisor/credentials.d.ts

@@ -14,7 +14,11 @@ export declare const STEP_GRANTS_PATH = "state/grants.json";
  */
 export declare const STEP_GRANTS_REF = "refs/heads/main";
 export type CredentialsSnapshotStep = {
-    /** Workflow step id from `WorkflowDefinition.stepOrder`. */
+    /**
+     * Workflow step id: a `WorkflowDefinition.stepOrder` entry, or a step id
+     * from one of the definition's `loop` bodies (a loop body shares the
+     * enclosing definition's flat step-id namespace).
+     */
     stepId: string;
     /** Mail address the step's agent presents to the bus. */
     address: string;
@@ -24,29 +28,29 @@ export type CredentialsSnapshotStep = {
     contentHash: string;
 };
 export type CredentialsSnapshot = {
-    /** Step-id keyed entries in `stepOrder` traversal order. */
+    /** Step-id keyed entries in the caller's traversal order. */
     steps: readonly CredentialsSnapshotStep[];
 };
 /**
  * Caller-supplied derivation of the per-step mail address from the
- * deployment id and step id. The supervisor cannot encode the
+ * run id and step id. The supervisor cannot encode the
  * deployment-domain inside library code; the wiring module supplies
  * the strategy the host owns.
  */
 export type DeriveStepAddress = (args: {
-    deploymentId: string;
+    runId: string;
     stepId: string;
 }) => string;
 /**
  * Caller-supplied override of the per-step `agent-state` repo identity
  * the supervisor reads grants from. Defaults to the
- * `<deploymentId>-<stepId>` convention (`defaultStepRepoId`); the
+ * `<runId>-<stepId>` convention (`defaultStepRepoId`); the
  * single-step launched-agent deploy supplies a derivation that returns
  * the legacy agent-state repo so the child reads grants from the same
  * repo the legacy agent identity already keys.
  */
 export type DeriveStepRepoId = (args: {
-    deploymentId: string;
+    runId: string;
     stepId: string;
 }) => RepoId;
 export type AssembleCredentialsSnapshotOpts = {
@@ -55,32 +59,40 @@ export type AssembleCredentialsSnapshotOpts = {
     /** Principal presented for each step's read. */
     principal: Principal;
     /**
-     * Step ids in the deployment's `stepOrder`. The trivial workflow
-     * passes a single entry; multi-step deployments pass every step in
-     * the order the workflow asset declared.
+     * Every step id the snapshot must carry an entry for. The trivial
+     * workflow passes a single entry; multi-step deployments pass every
+     * step in the order the workflow asset declared.
+     *
+     * This is the deployment's flat step-id namespace, which is WIDER than
+     * the definition's own `stepOrder`: a `loop` body runs in-process as a
+     * child run inheriting the parent's env, so a body step authorizes
+     * against this same snapshot under its own plain step id. The caller
+     * owns that widening -- it is the layer that holds the definition --
+     * and the snapshot is total over whatever it passes, because the
+     * child's authorize treats a missing entry as unrecoverable.
      */
     stepOrder: readonly string[];
-    /** Deployment id used in agent-state repo identity and address derivation. */
-    deploymentId: string;
+    /** Anchor run id used in agent-state repo identity and address derivation. */
+    anchorRunId: string;
     /** Per-step mail-address derivation callback. */
     deriveStepAddress: DeriveStepAddress;
     /**
      * Optional override for the `agent-state` repo's id. Callers that
-     * follow the documented convention (`<deploymentId>-<stepId>`) can
+     * follow the documented convention (`<runId>-<stepId>`) can
      * omit this; tests and bespoke layouts can supply their own.
      */
     deriveStepRepoId?: DeriveStepRepoId;
 };
 /**
- * Default mapping from `(deploymentId, stepId)` to the agent-state
- * repo id: `<deploymentId>-<stepId>`, isolating each step's grants in
+ * Default mapping from `(runId, stepId)` to the agent-state
+ * repo id: `<runId>-<stepId>`, isolating each step's grants in
  * its own repo. Applied to a one-step `stepOrder` it yields a single
  * such repo. The single-step launched-agent deploy overrides this
  * default (see `DeriveStepRepoId`) to reuse the legacy agent-state
  * repo.
  */
 export declare function defaultStepRepoId(args: {
-    deploymentId: string;
+    runId: string;
     stepId: string;
 }): RepoId;
 /**
@@ -99,3 +111,4 @@ export declare function hashGrants(grants: readonly unknown[]): Promise<string>;
  * arrives after a fresher one.
  */
 export declare function assembleCredentialsSnapshot(opts: AssembleCredentialsSnapshotOpts): Promise<CredentialsSnapshot>;
+export declare function isErrnoNotFound(cause: unknown): boolean;

package/dist/supervisor/credentials.js

@@ -20,7 +20,7 @@
 // substrate's git layout.
 //
 // Per-step address derivation (Q6.4 discovery decision):
-//   - Multi-step deployments use `<deploymentId>-<stepId>@<domain>`.
+//   - Multi-step deployments use `<runId>-<stepId>@<domain>`.
 //   - Trivial (single-step) deployments use the deployment's own
 //     mail address as the sole step's address.
 // The derivation is supplied by the caller as a `deriveStepAddress`
@@ -51,8 +51,8 @@ const StepGrantsFile = type({
     grants: "unknown[]",
 }).onUndeclaredKey("ignore");
 /**
- * Default mapping from `(deploymentId, stepId)` to the agent-state
- * repo id: `<deploymentId>-<stepId>`, isolating each step's grants in
+ * Default mapping from `(runId, stepId)` to the agent-state
+ * repo id: `<runId>-<stepId>`, isolating each step's grants in
  * its own repo. Applied to a one-step `stepOrder` it yields a single
  * such repo. The single-step launched-agent deploy overrides this
  * default (see `DeriveStepRepoId`) to reuse the legacy agent-state
@@ -61,7 +61,7 @@ const StepGrantsFile = type({
 export function defaultStepRepoId(args) {
     return {
         kind: "agent-state",
-        id: `${args.deploymentId}-${args.stepId}`,
+        id: `${args.runId}-${args.stepId}`,
     };
 }
 /**
@@ -128,12 +128,12 @@ export async function assembleCredentialsSnapshot(opts) {
     const steps = [];
     for (const stepId of opts.stepOrder) {
         const repoId = deriveRepoId({
-            deploymentId: opts.deploymentId,
+            runId: opts.anchorRunId,
             stepId,
         });
         const grants = await readStepGrants(opts, repoId);
         const address = opts.deriveStepAddress({
-            deploymentId: opts.deploymentId,
+            runId: opts.anchorRunId,
             stepId,
         });
         steps.push({
@@ -145,7 +145,7 @@ export async function assembleCredentialsSnapshot(opts) {
     }
     return { steps };
 }
-function isErrnoNotFound(cause) {
+export function isErrnoNotFound(cause) {
     if (cause === null || typeof cause !== "object")
         return false;
     const code = cause.code;

package/dist/supervisor/dispatch-attribution.js

@@ -21,7 +21,7 @@
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { countLooseObjects, gitBytes } from "@intx/storage-isogit";
+import { countLooseObjects, gitBytes } from "@intx/storage-isogit/node";
 const RUNS_DIR = "runs";
 const ADDRESSES_DIR = "addresses";
 const CONSUMED_DIR = "consumed";

package/dist/supervisor/drain-timeout.d.ts

@@ -16,8 +16,8 @@ export type DrainTimeoutOpts = {
     repoId: RepoId;
     /** Workflow-run repo ref the supervisor commits events to. */
     ref: string;
-    /** Deployment id baked into the supervisor's signing principal. */
-    deploymentId: string;
+    /** Anchor run id baked into the supervisor's signing principal. */
+    anchorRunId: string;
     /** Run id the drain is being escalated against. */
     runId: string;
     /**

package/dist/supervisor/drain-timeout.js

@@ -145,7 +145,7 @@ export function createDrainTimeoutAccumulator(opts) {
             substrate: opts.substrate,
             repoId: opts.repoId,
             ref: opts.ref,
-            deploymentId: opts.deploymentId,
+            anchorRunId: opts.anchorRunId,
             runId: opts.runId,
             origin,
             reason,

package/dist/supervisor/index.d.ts

@@ -1,7 +1,7 @@
-export { createWorkflowSupervisor, DEFAULT_TERMINAL_WRITE_WATCHDOG_MS, type CancelCommitInfo, type CancelRequestOpts, type DeliverSignalOpts, type DeliverSourcesOpts, type DrainOpts, type RecycleOpts, type SpawnOpts, type SpawnResult, type WorkflowSupervisor, } from "./supervisor.js";
-export { assembleCredentialsSnapshot, defaultStepRepoId, hashGrants, STEP_GRANTS_PATH, STEP_GRANTS_REF, type AssembleCredentialsSnapshotOpts, type CredentialsSnapshot, type CredentialsSnapshotStep, type DeriveStepAddress, type DeriveStepRepoId, } from "./credentials.js";
+export { createWorkflowSupervisor, type CancelCommitInfo, type CancelRequestOpts, type DeliverCredentialsOpts, type DeliverSignalOpts, type DeliverSourcesOpts, type DrainOpts, type RecycleOpts, type SpawnOpts, type SpawnResult, type WorkflowSupervisor, } from "./supervisor.js";
+export { assembleCredentialsSnapshot, isErrnoNotFound, defaultStepRepoId, hashGrants, STEP_GRANTS_PATH, STEP_GRANTS_REF, type AssembleCredentialsSnapshotOpts, type CredentialsSnapshot, type CredentialsSnapshotStep, type DeriveStepAddress, type DeriveStepRepoId, } from "./credentials.js";
 export { commitCancelRequested, SUPERVISOR_PRINCIPAL_KIND, type CommitCancelRequestedOpts, type CommitCancelRequestedResult, } from "./cancel-signing.js";
 export { createDrainTimeoutAccumulator, DEFAULT_DRAIN_TIMEOUT_MS, type DrainTimeoutAccumulator, type DrainTimeoutAccumulatorFactory, type DrainTimeoutOpts, } from "./drain-timeout.js";
 export { DEFAULT_KILL_TIMEOUT_MS } from "./child-termination.js";
 export { createRecyclePolicy, triggerRecycle, DEFAULT_POLICY_INTERVAL_MS, MAX_BUFFERED_MAIL, type ChildWiring, type RecycleAttempt, type RecycleContext, type RecycleOrigin, type RecyclePolicy, type RecyclePolicyBounds, type RecyclePolicyOpts, type TriggerRecycleOpts, } from "./recycle.js";
-export type { DeriveMailAuditRef, DispatchStructuralCounters, DispatchSubstrateLeg, DispatchTimingMark, InboxPrimitives, MailAuditRef, MailBusBindings, PrincipalSigner, SignedPayload, SubprocessHandle, SubprocessSpawner, TerminalEventSource, TerminalRunEvent, WorkflowSupervisorBindings, WorkflowSupervisorPrincipalKind, } from "./types.js";
+export type { DeriveMailAuditRef, DispatchStructuralCounters, DispatchSubstrateLeg, DispatchTimingMark, InboxPrimitives, MailAuditRef, MailBusBindings, PrincipalSigner, SignedPayload, SubprocessHandle, SubprocessSpawner, SuspensionRegistration, TerminalEventSource, TerminalRunEvent, WorkflowSupervisorBindings, WorkflowSupervisorPrincipalKind, } from "./types.js";

package/dist/supervisor/index.js

@@ -1,5 +1,5 @@
-export { createWorkflowSupervisor, DEFAULT_TERMINAL_WRITE_WATCHDOG_MS, } from "./supervisor.js";
-export { assembleCredentialsSnapshot, defaultStepRepoId, hashGrants, STEP_GRANTS_PATH, STEP_GRANTS_REF, } from "./credentials.js";
+export { createWorkflowSupervisor, } from "./supervisor.js";
+export { assembleCredentialsSnapshot, isErrnoNotFound, defaultStepRepoId, hashGrants, STEP_GRANTS_PATH, STEP_GRANTS_REF, } from "./credentials.js";
 export { commitCancelRequested, SUPERVISOR_PRINCIPAL_KIND, } from "./cancel-signing.js";
 export { createDrainTimeoutAccumulator, DEFAULT_DRAIN_TIMEOUT_MS, } from "./drain-timeout.js";
 export { DEFAULT_KILL_TIMEOUT_MS } from "./child-termination.js";

package/dist/supervisor/recycle.d.ts

@@ -18,9 +18,12 @@ export declare const DEFAULT_POLICY_INTERVAL_MS = 60000;
 /**
  * Origin tag the recycle path stamps onto its log messages so an
  * operator scanning logs can distinguish operator-initiated,
- * policy-initiated, and self-initiated recycles at a glance.
+ * policy-initiated, self-initiated, and crash-respawn origins at a
+ * glance. The `crash` origin drives the same respawn sequence after an
+ * unexpected child exit; see the six-step header note about steps 1-2
+ * degrading to no-ops for it.
  */
-export type RecycleOrigin = "operator" | "policy" | "self";
+export type RecycleOrigin = "operator" | "policy" | "self" | "crash";
 export interface RecycleAttempt {
     /** Origin the recycle was initiated from. */
     readonly origin: RecycleOrigin;
@@ -53,7 +56,11 @@ export interface ChildWiring {
 export interface RecycleContext {
     /** The supervisor's full bindings, reused on respawn for credentials and spawn. */
     readonly bindings: WorkflowSupervisorBindings;
-    /** Step ids in this deployment's `stepOrder` for credentials re-assembly. */
+    /**
+     * Every step id in this deployment's flat step-id namespace -- the
+     * definition's own `stepOrder` plus the step ids of every `loop` body it
+     * carries -- for credentials re-assembly.
+     */
     readonly stepOrder: readonly string[];
     /** Definition hash carried on respawn env (unchanged across recycle). */
     readonly definitionHash: string;